Cloud Security Architecture & AI Defense

Stories, research, and engineering blueprints covering CSPM, Microsoft Defender for Cloud, and securing generative AI pipelines.

For you Latest Topic: #KQL ×

All Topics KQL Cloud Security Azure DevSecOps Entra ID Microsoft Sentinel AI Security Threat Hunting

Dikshant Lather · Sep 25, 2026

Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID

Detect sudden activity from long-dormant Service Principals and App Registrations that may indicate compromised client secrets or abandoned credentials.

Identity Security 2 min read

0 0

Identifying Inactive and Dormant Service Principals Misuse in Microsoft Entra ID

Dikshant Lather · Sep 25, 2026

Spotting Web Shell Execution: Web Server Spawning Suspicious Child Processes

Detect web server compromises and web shell activity by identifying suspicious interactive shells spawned by IIS (w3wp.exe), Nginx, or Apache.

Endpoint Detection 2 min read

0 0

Spotting Web Shell Execution: Web Server Spawning Suspicious Child Processes

Dikshant Lather · Sep 25, 2026

Detecting Persistence via Windows Scheduled Task Creation Using KQL

Hunt for adversary persistence via unauthorized Windows Scheduled Tasks by parsing Security Event ID 4698 and DeviceProcessEvents in KQL.

Threat Hunting 2 min read

0 0

Detecting Persistence via Windows Scheduled Task Creation Using KQL

Dikshant Lather · Sep 25, 2026

Identifying Rogue Azure Subscription Role Assignments and Privilege Escalation

Monitor high-privilege Azure RBAC grant operations (Owner, Contributor, User Access Administrator) in AzureActivity logs using proactive KQL alert rules.

Cloud Security 2 min read

0 0

Identifying Rogue Azure Subscription Role Assignments and Privilege Escalation

Dikshant Lather · Sep 25, 2026

Hunting for Kerberoasting Attacks via Kerberos Service Ticket Requests (Event ID 4769)

Uncover Kerberoasting attacks targeting Active Directory Service Principal Names (SPNs) using KQL anomaly detection on Windows Security Event ID 4769.

Active Directory Security 2 min read

0 0

Hunting for Kerberoasting Attacks via Kerberos Service Ticket Requests (Event ID 4769)

Dikshant Lather · Sep 25, 2026

Detecting MFA Fatigue and Push Notification Bombing in Microsoft Entra ID

Catch MFA push notification bombing attacks where attackers trigger repeated authentication requests until the victim accidentally approves access.

Identity Security 2 min read

0 0

Detecting MFA Fatigue and Push Notification Bombing in Microsoft Entra ID

Dikshant Lather · Sep 25, 2026

Detecting Mass Exfiltration and File Downloads in SharePoint & OneDrive

Identify anomalous mass file download operations and data hoarding across SharePoint Online and OneDrive for Business using statistical KQL baseline thresholds.

Cloud Security 2 min read